CompTIA CAS-005 Practice Test 22
Question 210
In Telemedicine messaging network, a security issue affects session key compromise: old TLS gateway permits session replay from captured traffic after server key theft. The observed evidence is that packet lab reproduces decryption of historical weak RSA-key-exchange sessions. Operations must account for this constraint: recorded patient conversations must remain confidential long-term. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Require authenticated ephemeral key agreement with forward secrecy and modern AEAD
- Rotate the static RSA certificate while keeping non-ephemeral key exchange
- Monitor fallback cipher negotiations and expired certificates
- Roll out compatible modern TLS profiles with staged client updates
Explanation
Correct Answer
D:Roll out compatible modern TLS profiles with staged client updates provides a governed means to introduce the chosen safeguard while respecting recorded patient conversations must remain confidential long-term. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
B:Replacing a key today cannot retroactively protect sessions decryptable from an old one. The immediate requirement for session key compromise is safe implementation, which this alternative does not provide.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves session key compromise and packet lab reproduces decryption of historical weak RSA-key-exchange sessions.
Question 211
In Municipal citizen portal, a security issue affects build promotion approvals: developers can bypass production review by merging to an unprotected branch. The observed evidence is that pipeline audit shows direct deployment from a personal token. Operations must account for this constraint: citizen services cannot tolerate untested hotfixes. Before declaring the control effective, which test should exercise both the affected path and permitted behavior?
- Trace branch permissions, token scope and route from commit to production
- Stage service-account rotation and gate enforcement with emergency release path
- Attempt an unauthorized promotion and confirm independent approval blocks it
- Add SAST findings to the pipeline but retain unapproved deployment access
Explanation
Correct Answer
C:Attempt an unauthorized promotion and confirm independent approval blocks it tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
A:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
B:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves build promotion approvals and pipeline audit shows direct deployment from a personal token.
D:Code scanning does not replace release authorization controls. The immediate requirement for build promotion approvals is verified remediation, which this alternative does not provide.
Question 212
In Regional securities exchange, a security issue affects insider database exfiltration: large exports precede employee departure and newly created external share. The observed evidence is that database audit and DLP alert identify same query session. Operations must account for this constraint: regulated trading records require immutable legal hold. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Disable all audit logging to reduce storage during investigation
- Track sensitive data exports and personnel-access offboarding gaps
- Test denial of unauthorized bulk export and integrity of retained evidence
- Revoke unauthorized sharing and enforce purpose-scoped database export rights
Explanation
Correct Answer
B:Track sensitive data exports and personnel-access offboarding gaps identifies future loss of control, changed dependencies and exceptions affecting insider database exfiltration. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
A:Missing evidence prevents attribution and regulatory response. The immediate requirement for insider database exfiltration is ongoing assurance, which this alternative does not provide.
C:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
D:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves insider database exfiltration and database audit and DLP alert identify same query session.
Question 213
In Child-learning platform, a security issue affects minor account onboarding: marketing proposes consent reuse for analytics across regions with different child-privacy obligations. The observed evidence is that data-flow draft merges parental consent and unrelated profiling purposes. Operations must account for this constraint: learning access must remain available without optional tracking. The team must distinguish a real control failure from assumptions about the observation. Which evidence-led action is most appropriate?
- Assume general platform terms authorize all future profiling of minors
- Introduce region-specific consent gates and rollback-safe tracking disablement
- Separate necessary service processing from optional profiling with enforceable purpose limitation
- Identify applicable age, consent, purpose and deletion requirements for each region
Explanation
Correct Answer
D:Identify applicable age, consent, purpose and deletion requirements for each region connects the reported evidence (data-flow draft merges parental consent and unrelated profiling purposes) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
A:Broad contractual language cannot replace required purpose-specific legal consent. The immediate requirement for minor account onboarding is evidence assessment, which this alternative does not provide.
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
C:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves minor account onboarding and data-flow draft merges parental consent and unrelated profiling purposes.
Question 214
In International charity, a security issue affects confidential donation analytics: organization needs public totals but transaction identifiers must not be reversible. The observed evidence is that proposal hashes low-entropy donor IDs without secret and publishes them. Operations must account for this constraint: donor privacy commitments prohibit individual tracking. The current report records a symptom but not its complete cause or trust boundary. Which assessment should the team perform?
- Evaluate reidentification risk and identifier entropy of planned release
- Use aggregation and irreversible privacy-preserving tokenization with access controls
- Pilot publication of aggregate statistics following disclosure review
- Publish raw SHA-256 hashes of predictable donor identifiers
Explanation
Correct Answer
A:Evaluate reidentification risk and identifier entropy of planned release connects the reported evidence (proposal hashes low-entropy donor IDs without secret and publishes them) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
C:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves confidential donation analytics and proposal hashes low-entropy donor IDs without secret and publishes them.
D:Hashing guessable IDs does not ensure anonymity against dictionary attacks. The immediate requirement for confidential donation analytics is evidence assessment, which this alternative does not provide.
Question 215
In Global logistics broker, a security issue affects cross-border shipment metadata: partner processor moves customer data to an unapproved country and subcontractor. The observed evidence is that processing records show new storage region and an undisclosed subprocessor. Operations must account for this constraint: shipment tracking must remain functional during remediation. The owner requests acceptance evidence, rather than a deployment success message. Which validation is most conclusive?
- Check actual object-location logs, subprocessor records and cross-border transfer proofs
- Rely solely on the prime provider's marketing claim of global compliance
- Map legally applicable location restrictions and full downstream processing and access paths
- Apply approved region restrictions and temporary least-data sharing before partner cutover
Explanation
Correct Answer
A:Check actual object-location logs, subprocessor records and cross-border transfer proofs tests whether the original failure can still occur and whether authorized activity continues to work. A change ticket or rollout confirmation is weaker than direct acceptance evidence.
Incorrect Answers
B:A generic assurance statement does not establish location or subcontractor compliance. The immediate requirement for cross-border shipment metadata is verified remediation, which this alternative does not provide.
C:Cause analysis belongs before implementation; it is not a retest of the deployed control on the originally affected path. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
D:A governed rollout makes the solution live, but installation and rollback readiness do not establish effectiveness. In this case, the evidence involves cross-border shipment metadata and processing records show new storage region and an undisclosed subprocessor.
Question 216
In Retail fraud analytics vendor, a security issue affects claims model training pipeline: contractor can poison labeled training rows without independent provenance. The observed evidence is that version control shows unreviewed data-label changes before a model drift spike. Operations must account for this constraint: fraud detection must not silently block legitimate purchases. Normal operations have resumed; leadership now wants sustained assurance rather than another one-time deployment. What should be tracked?
- Track drift, poisoning indicators and training approval exceptions across releases
- Reproduce baseline metrics and adversarial label-poisoning tests on held-out samples
- Require signed dataset lineage, controlled label changes and integrity-based retraining gates
- Add more output filtering while leaving the training data channel untrusted
Explanation
Correct Answer
A:Track drift, poisoning indicators and training approval exceptions across releases identifies future loss of control, changed dependencies and exceptions affecting claims model training pipeline. Successful initial testing alone does not establish that the safeguard will remain effective.
Incorrect Answers
B:A one-time retest may miss later identity, supplier or configuration changes; continuing assurance is required. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
C:Designing the safeguard is an earlier stage; ongoing assurance needs operational evidence of drift or bypass. In this case, the evidence involves claims model training pipeline and version control shows unreviewed data-label changes before a model drift spike.
D:Output-only checks do not repair compromised model inputs. The immediate requirement for claims model training pipeline is ongoing assurance, which this alternative does not provide.
Question 217
In National museum archive, a security issue affects historic media preservation: a destructive storage fault could corrupt rare master files with no recent integrity proofs. The observed evidence is that one archive replica passes availability checks but checksum baselines disagree. Operations must account for this constraint: public exhibition must continue read-only. The owner needs a defensible cause and scope analysis, not yet a production fix. What should be investigated?
- Trace integrity roots, replica independence and the first verified divergence
- Quarantine divergent replicas while staging a verified master restore under change control
- Declare every readable file valid because its storage device is online
- Design signed hash manifests, offline immutable masters and documented restoration authority
Explanation
Correct Answer
A:Trace integrity roots, replica independence and the first verified divergence connects the reported evidence (one archive replica passes availability checks but checksum baselines disagree) to the underlying control, authority or dependency path. A justified mitigation requires knowing the real scope of the issue, not guessing from its label.
Incorrect Answers
B:Changing production before understanding the reported path could act on the wrong cause and disrupt service. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
C:Availability says nothing about authenticity or bit-level integrity. The immediate requirement for historic media preservation is evidence assessment, which this alternative does not provide.
D:Proposing the control before establishing the scope would assume that the observed event arises from the expected trust boundary. In this case, the evidence involves historic media preservation and one archive replica passes availability checks but checksum baselines disagree.
Question 218
In Clinical laboratory, a security issue affects obsolete analyzer integration: unsupported Windows host controls diagnostic analyzer with no vendor patch path. The observed evidence is that scan flags old SMB service exposed to general office subnet. Operations must account for this constraint: diagnostic runs cannot be interrupted for operating-system migration. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Isolate analyzer behind protocol allowlist and monitored transfer gateway
- Map exact analyzer dependencies, clinical safety and network exposure
- Review restricted host use and compensating controls while replacement is planned
- Force immediate unsupported OS upgrade on live clinical controller
Explanation
Correct Answer
A:Isolate analyzer behind protocol allowlist and monitored transfer gateway is the durable measure that addresses the observed weakness: unsupported Windows host controls diagnostic analyzer with no vendor patch path. It must be enforceable while preserving the stated constraint: diagnostic runs cannot be interrupted for operating-system migration.
Incorrect Answers
B:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves obsolete analyzer integration and scan flags old SMB service exposed to general office subnet.
D:Unvalidated upgrades can disrupt calibrated medical equipment. The immediate requirement for obsolete analyzer integration is durable control selection, which this alternative does not provide.
Question 219
In Online procurement platform, a security issue affects DMARC anti-spoofing: vendor invoices from authorized service are quarantined due to DKIM misalignment. The observed evidence is that headers show SPF passing for relay domain but DMARC failing From alignment. Operations must account for this constraint: finance must receive genuine supplier notices without spoofing bypass. A completed diagnosis now needs an enforceable control architecture. Which control best resolves the documented weakness?
- Inspect From, envelope sender, SPF domain, DKIM d= and alignment result
- Set DMARC policy p=none permanently without fixing misalignment
- Monitor DMARC aggregate reports, failure reasons and new legitimate senders
- Configure aligned DKIM signing for authorized invoice sender and strict DMARC
Explanation
Correct Answer
D:Configure aligned DKIM signing for authorized invoice sender and strict DMARC is the durable measure that addresses the observed weakness: vendor invoices from authorized service are quarantined due to DKIM misalignment. It must be enforceable while preserving the stated constraint: finance must receive genuine supplier notices without spoofing bypass.
Incorrect Answers
A:Investigation characterizes the problem, but the case already establishes the failure path and asks for an enforceable control. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
B:Removing enforcement masks spoofing rather than aligning the legitimate flow. The immediate requirement for DMARC anti-spoofing is durable control selection, which this alternative does not provide.
C:Monitoring after rollout is not a substitute for specifying the control that should be enforced. In this case, the evidence involves DMARC anti-spoofing and headers show SPF passing for relay domain but DMARC failing From alignment.
Question 220
In Regional publishing company, a security issue affects cloud API exposure: production endpoint lacks per-user object authorization after a serverless migration. The observed evidence is that logs show access by valid token to another account's draft documents. Operations must account for this constraint: low-latency publishing cannot depend on manual review for each request. The new design passed review, but deployment must preserve critical services. Which controlled rollout best fits?
- Apply only per-IP rate limiting to the exposed endpoint
- Enforce object-level authorization in function and least-privilege backing store access
- Monitor authorization failure trends and new unreviewed API routes
- Roll out authorized request checks with tenant canaries and rollback plan
Explanation
Correct Answer
D:Roll out authorized request checks with tenant canaries and rollback plan provides a governed means to introduce the chosen safeguard while respecting low-latency publishing cannot depend on manual review for each request. A sound design without a safe, authorized rollout does not establish operating protection.
Incorrect Answers
A:Rate limiting does not prevent an authorized token reading the wrong tenant. The immediate requirement for cloud API exposure is safe implementation, which this alternative does not provide.
B:The design has already been selected and approved; choosing it again does not make a reversible operational change. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
C:Future assurance does not install the approved change under the current availability constraint. In this case, the evidence involves cloud API exposure and logs show access by valid token to another account's draft documents.
